cancel
Showing results for 
Search instead for 
Did you mean: 
Read only

SAP Fiori Security Basics

Sahoo
Discoverer
6,849

Agenda

  • Introduction to SAP Fiori
  • Fiori Contents (Tiles, Catalogs, Groups, Spaces, Pages, Sections)
  • Fiori OData service, Target Mappings, Apps library
  • Fiori Deployments
  • Fiori Authorization and Security Activities
  • Fiori Role Design Approach
  • Fiori Troubleshooting

    Introduction to Fiori

    • SAP Fiori is a user interface technology that provides access to SAP system via apps. It’s an alternative to SAP GUI Logonpad.
    • Fiori interface is accessible via Fiori Launchpad (FLP) which is a web URL provided by Basis team (FLP is also opened when tcode /n/ui2/flp is executed).

      Fiori Tiles / Apps

      • A tile is a container that represents an app on the Fiori launchpad page. So, it’s used to display and launch app on the Fiori launchpad.
      • There are 3 types of Fiori apps: Transactional, Analytical, Factsheet

        –Transactional Apps: These apps let you perform transactional tasks, such as creating travel requests and approving purchase orders. They represent simplified views and interaction with existing business processes and solutions. They run best on an SAP HANA database but can also be ported to other databases with acceptable performance.

        –Analytical Apps: Analytical apps provide real-time analysis of business operations by displaying a large volume of data analytically. These apps run on an SAP HANA database.

        –Factsheets: These apps display contextual information and key facts about central objects used in your business operations. For example, you can navigate from a document to the related business partner or to the master data.

        Fiori Catalogs and Groups

        SAP Fiori apps are organized through catalogs and groups.

        • Catalog:

          –Catalog contains set of apps/tiles. Catalogs are assigned to roles. Users can browse through the list and choose the tile that they want to display on the entry page of SAP Fiori Launchpad.

          • Group:

            –A group is a subset of Applications from one or more catalogs. Which tiles are displayed on a user’s Home page depends on the groups assigned to the user’s role. In addition, the user can personalize the entry Fiori page by adding or removing Applications to pre-delivered groups or self-defined groups.

             Fiori Spaces, Pages and Sections

            Spaces and Pages is part of new layout design of Fiori launchpad which is called Fiori 3.0.

            • Space/Page contains subset of apps from one or more catalogs. Tiles are displayed on a user’s launchpad depending on the spaces assigned to the user’s role. User can personalize the pages by adding or removing tiles from assigned catalogs.
            • A space is represented as a navigation item in the top-level navigation, and a space can have one or more pages. A page consists of sections that are used to further structure the content. Sections are optional.

              Fiori OData service, Target Mappings, Apps Library

              • OData is a resource-based web protocol for querying and updating data. OData defines operations on resources using HTTP commands (for example, GET, PUT, POST, and DELETE). To provide users with the UI access to Apps, start authorization for the activated OData services used by apps must be granted. OData services are service type and access is given through Authorization default from PFCG menu and services are added to S_SERVICE authorization object. Frontend OData services are denoted as IWSG and IWSV is for backend OData services.
              • A tile contains the intent, which defines what action needs to be taken, such as Create a Sales Order, but to execute the intent, a navigation target is needed to launch the application. This is done with the help of another UI content entity known as target mapping. To launch an application, both tile and target mapping are needed.
              • SAP Fiori Apps Reference Library is the single point information to all SAP Fiori apps. You will nee...

                –Required back-end system version

                –OData service

                –Target mapping

                –Technical / Business Catalog

                –Business Group

                –Business Role

                Fiori Deployments

                Before discussing Fiori deployments, let’s understand front-end and back-end servers.

                Front-end server is a system where Fiori components are installed whereas back-end server refers to the system that contains the business logics to fetch data from database.

                There are two deployment options for SAP Fiori for on-premise SAP systems: Central Hub and Embedded.

                Fiori Authorization

                • The end-user requires basic authorizations to start and use the SAP Fiori Launchpad. SAP delivers predefined role templates for end-users, as well as for administrators. The roles are:

                  -> SAP_UI2_USER_700 (new role SAP_FLP_USER) for end-users

                  -> SAP_UI2_ADMIN_700 (new role SAP_FLP_ADMIN) for administrators

                  • Custom roles must be built by copying above roles for user assignment. These table represents the OData services needed for users.
                  • Please note that both IWSG and IWSV services access must be given and FDM services are required to manage Fiori with Space/Page design.

                     

                    • To create space/page, admin needs access to below apps.

                      Fiori Security Activities (Creating a custom catalog)

                      Execute tcode /n/ui2/flpd_cust to open the Fiori launchpad designer and follow the steps as mentioned in below screenshot to create a custom catalog.

                      Fiori Security Activities (Adding a Fiori app in custom catalog)

                      Let’s understand how to add a Fiori app called ‘Create Inbound Delivery’ in custom catalog created earlier.

                      From Fiori Apps Library, we can find the Target Mapping and the standard catalog where this app exists.

                      Sahoo_15-1720462385252.png

                      Sahoo_14-1720462338596.png

                      Sahoo_13-1720462299023.png

                    Sahoo_12-1720462274909.png

                Sahoo_11-1720462209507.png

                Sahoo_5-1720462108953.png

              Sahoo_3-1720462048618.png

            Sahoo_1-1720462006866.png

        Sahoo_0-1720461966799.png

Accepted Solutions (0)

Answers (1)

Answers (1)

Jocelyn_Dart
Product and Topic Expert
Product and Topic Expert

Hmmm did you have a question Sahoo ? Or were you trying to post a blog by members? 

Great if you want to do that ... however unfortunately most of the information above is rather outdated. It would have been correct for S/4HANA release 1909 but the current release is 2023 so things have moved on quite a bit!

You might want to skill up by reading the latest official SAP Help documentation for the SAP Fiori launchpad where best practices are described i.e. 

The User Management and Authorizations section of the SAP Fiori Overview guide

Section Setting Up Authorization Roles in the SAP Fiori Launchpad Administration Guide

You should also find these blogs useful:

SAP Fiori for SAP S/4HANA – SAP Fiori Security Design Fundamentals

SAP Fiori for SAP S/4HANA - Composite Roles in launchpad content and layout tools

SAP Fiori for SAP S/4HANA - Technical Catalog Migration – Why and Getting Ready for Migration

SAP Fiori for SAP S/4HANA – Upgrade Faster – Managing app lifecycle impacts on users